Security Work Quick Reference Guide

Security Work Quick Reference Guide

Last Updated: November 9, 2025 Phase: V7.0 Roadmap - Phase 1 Month 1

---

TL;DR - What You Need to Know

Current Status

• Security Grade: 6.5/10 → Target: 9.0/10
• Progress: 2/8 critical issues complete
• Investment: $600K, 4 weeks
• Team: 2 Senior Engineers + 1 Security Consultant

Week 1 Priorities (Nov 9-15)

1. Fix 250 unwrap() calls (storage, protocols, streaming)
2. WASM security audit Phase 1 (42 unsafe blocks)
3. Verify heliosdb-security crate clean ( done)

Week 2 Priorities (Nov 16-22)

1. Deploy global query timeout (30s)
2. Deploy per-query memory limits (100MB)
3. Deploy global rate limiting (100 req/sec)
4. WASM hardening implementation

---

8 Critical Security Issues - At a Glance

#	Issue	Status	Priority	Week
1	SQL Injection	COMPLETE	-	-
2	unwrap() Calls (12,119 total)	🟡 14 fixed	P0	1-4
3	WASM Sandbox (42 unsafe blocks)	🔴 NOT STARTED	P0	1-2
4	Resource Leaks	🟡 PARTIAL	P1	2
5	JWT Validation	COMPLETE	-	-
6	Rate Limiting	🟡 PARTIAL	P1	2
7	Auth Bypass	🟡 NEEDS TESTING	P1	3
8	Input Validation	🟡 PARTIAL	P1	3-4

---

Top 4 Critical Crates (unwrap() Counts)

1. heliosdb-storage: 986 unwraps (14 fixed )

   • xa_participant.rs: 52 (SystemTime pattern)
   • xa_log.rs: 21
   • compaction.rs: 14

2. heliosdb-protocols: 765 unwraps

   • No specific files identified yet

3. heliosdb-security: 302 unwraps (ALL IN TESTS )

   • Production code: CLEAN
   • Action: None required

4. heliosdb-streaming: 492 unwraps

   • No specific files identified yet

---

WASM Security - Critical Findings

42 Unsafe Blocks Found (not 56)

• 19 blocks: wasm-sdk/src/host.rs (FFI, raw pointers)
• 7 blocks: wasm-sdk/src/loader.rs (memory ops)
• 5 blocks: wasm-sdk/src/edge.rs (edge FFI)
• 5 blocks: wasm-sdk/src/tracing.rs (tracing FFI)
• 6 blocks: Other files

Top 2 Sandbox Escape Vectors

Vector 1: Unbounded memory read

// wasm-sdk/src/lib.rs:202
unsafe {
    std::slice::from_raw_parts(input_ptr as *const u8, input_len as usize)
    // NO BOUNDS CHECK!
}

Vector 2: Raw pointer FFI

// wasm-sdk/src/host.rs:94
unsafe {
    let data = std::slice::from_raw_parts(out_ptr, out_len);
    // NO VALIDATION!
}

Immediate Actions Required

1. Add bounds checking to all raw pointer operations
2. Implement pointer validation layer
3. Add memory limits (1GB per instance)
4. Add CPU limits (1s per invocation)
5. Fuzz testing (100K iterations)

---

Week-by-Week Targets

Week 1 (Nov 9-15)

• unwraps fixed: 250 (2.1% of total)
• WASM audit: Phase 1 complete
• Security grade: 7.0/10

Week 2 (Nov 16-22)

• unwraps fixed: 500 total (4.1%)
• Resource limits: Deployed
• Rate limiting: Deployed
• WASM hardening: Complete
• Security grade: 7.5/10

Week 3 (Nov 23-29)

• unwraps fixed: 1,000 total (8.2%)
• Pen testing: Complete
• Input validation: Deployed
• Security grade: 8.5/10

Week 4 (Nov 30-Dec 6)

• unwraps fixed: 2,000 total (16.5%)
• All critical issues: Resolved
• Security grade: 9.0/10
• Status: PRODUCTION-READY

---

Daily Checklist

Monday

• Daily security standup (9am, 15min)
• Review previous day’s fixes
• Update progress tracking
• Identify blockers

Daily Tasks

• Fix 35-50 unwraps (per engineer)
• Write/update tests
• Code review security fixes
• Update documentation

Friday

• Weekly security review
• Demo to stakeholders
• Plan next week
• Update roadmap

---

Common Patterns

unwrap() Fix Pattern

// BEFORE
let value = collection.last().unwrap();

// AFTER
let value = collection
    .last()
    .ok_or_else(|| HeliosError::Storage(
        "Collection unexpectedly empty".to_string()
    ))?;

SystemTime Pattern (xa_participant.rs)

// BEFORE
let duration = SystemTime::now()
    .duration_since(UNIX_EPOCH)
    .unwrap();

// AFTER
let duration = SystemTime::now()
    .duration_since(UNIX_EPOCH)
    .unwrap_or_else(|_| Duration::from_secs(0));

Pointer Validation Pattern

// BEFORE
unsafe {
    let data = std::slice::from_raw_parts(ptr, len);
}

// AFTER
unsafe {
    // Validate bounds
    if ptr < 0 || len < 0 {
        return Err(WasmError::InvalidPointer);
    }

    let end = (ptr as usize).checked_add(len as usize)
        .ok_or(WasmError::PointerOverflow)?;

    if end > WASM_MEMORY_SIZE {
        return Err(WasmError::OutOfBounds);
    }

    let data = std::slice::from_raw_parts(ptr as *const u8, len as usize);
}

---

Key Contacts

Internal Team

• Senior Engineer #1: storage, protocols
• Senior Engineer #2: streaming, rate limiting
• Security Consultant: WASM audit, pen testing

External Vendors

• WASM Security Audit: Vendor selection in progress (Trail of Bits, NCC Group, or Cure53)
• Penetration Testing: Scheduled for Phase 1 Week 3

---

Important Files

Documentation

• /docs/PHASE1_SECURITY_PRIORITY_MATRIX.md - Full detailed report
• /docs/SECURITY_AUDIT_REPORT.md - Initial audit findings
• /docs/SECURITY_REMEDIATION_PLAN.md - Original 4-week plan
• /docs/SECURITY_FIX_PROGRESS_NOV_9.md - Day 1 progress

Code Locations

• Storage crate: /heliosdb-storage/src/
• Security crate: /heliosdb-security/src/
• WASM runtime: /heliosdb-wasm/src/
• WASM SDK: /heliosdb-wasm-sdk/src/

---

Budget Breakdown

Category	Amount	Notes
Senior Engineers (2)	$200K	4 weeks × 2 engineers
Security Consultant	$150K	3.5 weeks full-time
External Pen Test	$100K	Week 3
WASM Security Audit	$70K	Weeks 1-2
Tooling	$25K	CI/CD, monitoring
Contingency (10%)	$55K	Buffer for unknowns
TOTAL	$600K	-

---

Success Metrics

Technical

• Security grade: 6.5/10 → 9.0/10
• Critical issues: 8 → 0
• High issues: 15 → 0
• unwrap() fixed: 14 → 2,000
• WASM unsafe secured: 0 → 42

Business

• Production readiness: 30% → 80%
• Beta deployment: BLOCKED → READY
• Enterprise trust: LOW → HIGH

---

Quick Commands

Count unwraps

# Storage crate (non-test)
grep -r "\.unwrap()" --include="*.rs" heliosdb-storage/src/ | grep -v "/tests/" | wc -l

# Security crate (production only)
grep -r "\.unwrap()" --include="*.rs" heliosdb-security/src/ | grep -v "/tests/" | wc -l

Count unsafe blocks

# WASM crates
grep -r "unsafe" --include="*.rs" heliosdb-wasm*/src/ | wc -l

Run tests

# Storage crate
cargo test -p heliosdb-storage

# Security crate
cargo test -p heliosdb-security

# WASM
cargo test -p heliosdb-wasm -p heliosdb-wasm-sdk

Build specific crate

cargo build --package heliosdb-storage
cargo build --package heliosdb-wasm

---

Red Flags - When to Escalate

1. Unwrap() fix breaks tests → Escalate to tech lead
2. WASM audit finds critical vulnerability → Escalate to CTO
3. Penetration test fails → Escalate to executive team
4. Timeline slipping >2 days → Escalate to project manager
5. Budget overrun >10% → Escalate to CFO

---

Resources

Documentation

• Wasmtime Security
• Rust Unsafe Code Guidelines
• OWASP Top 10

Tools

• Clippy lints: clippy::unwrap_used, clippy::expect_used
• Cargo audit: cargo audit
• Cargo deny: cargo deny check

---

Last Updated: November 9, 2025 Maintained By: Security Team Questions?: Ask in #security-hardening channel